CVSS 4.0
5.1 mediumCVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:NCVE-2026-27122
Medium (5.1) in svelte svelte. EPSS 0.2% chance of exploitation in the next 30 days. Fixed in svelte 5.51.5.
svelte performance oriented web framework. Prior to 5.51.5, when using <svelte:element this={tag}> in server-side rendering, the provided tag name is not validated or sanitized before being emitted into the HTML output. If the tag string contains unexpected characters, it can result in HTML injection in the SSR output. Client-side rendering is not affected. This vulnerability is fixed in 5.51.5.
Severity
CVSS 3.1
5.4 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N- EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 12% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- svelte:svelte
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-m56q-vw4c-c2cp | npm | svelte | <5.51.5 | 5.51.5 |